SECAI Core · phase 12 of 15
Dynamic application security testing
Testing that is done after code is placed into production and is able to unearth vulnerabilities that are evident once the code is in production.
The Explain card
- Plain English
- DAST tests a running application from the outside, probing it the way an attacker would, to uncover vulnerabilities that only appear once the code is deployed and live.
- Example
- A DAST tool fires crafted requests at a deployed chatbot API and discovers that error responses reveal the system prompt and internal hostnames.
- Why it matters
- Some flaws exist only in configuration, integration, or runtime behavior that static review cannot see. For AI endpoints, DAST-style probing is how you learn what the model actually leaks under pressure.
- Hook
- Kicking the tires on the car that is already on the road.
Where it sits in the deck
Phase 12: Defensive Technologies and Secure Development Practices
Map defences directly to the attacks just catalogued — the technical controls, secure coding practices, and protective tools that harden AI and traditional systems alike.
